Skip to content

Commit 11eeefc

Browse files
eset-researcheset-research
committed
Add ScarCrut Dolphin backdoor IOCs
1 parent a20ba9c commit 11eeefc

File tree

4 files changed

+41
-0
lines changed

4 files changed

+41
-0
lines changed

‎scarcruft/README.adoc

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
= ScarCruft Indicators of Compromise
2+
3+
== Dolphin
4+
5+
The blog post about Dolphin is available on WeLiveSecurity at
6+
https://www.welivesecurity.com/2022/11/30/whos-swimming-south-korean-waters-meet-scarcrufts-dolphin/
7+
8+
=== ESET detection names
9+
10+
- Win64/Agent.MS
11+
- Win32/Spy.Agent.QET
12+
- Win64/Agent.MS
13+
- Win32/Agent.UYO
14+
- Win64/Agent.MS
15+
16+
=== Host based indicators
17+
18+
==== SHA-1 hashes
19+
20+
----
21+
D9A369E328EA4F1B8304B6E11B50275F798E9D6B
22+
F9F6C0184CEE9C1E4E15C2A73E56D7B927EA685B
23+
2C6CC71B7E7E4B28C2C176B504BC5BDB687C4D41
24+
5B70453AB58824A65ED0B6175C903AA022A87D6A
25+
21CA0287EC5EAEE8FB2F5D0542E378267D6CA0A6
26+
----

‎scarcruft/samples.md5

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
0bd494830049d72f015da64a407e9813
2+
8602aaca3ea117d7c948e4bee0aac2c8
3+
1f3c8879349d5fcf973abbcee82fd069
4+
4b1cdff75d17f3f220153e8f42ab58c0
5+
83d0381907cbb1e2ed5973ec76452695

‎scarcruft/samples.sha1

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
d9a369e328ea4f1b8304b6e11b50275f798e9d6b
2+
f9f6c0184cee9c1e4e15c2a73e56d7b927ea685b
3+
2c6cc71b7e7e4b28c2c176b504bc5bdb687c4d41
4+
5b70453ab58824a65ed0b6175c903aa022a87d6a
5+
21ca0287ec5eaee8fb2f5d0542e378267d6ca0a6

‎scarcruft/samples.sha256

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
486bd76669fc2c0adc25a5498b42c1df5fc90514866d78318f8954aa0c67eacc
2+
8282de02dd899f11011720db7e69826cac1f34f4a90c59f6405614bb991d3015
3+
88d7aa96f00bcec816130950f4b851dddb17dcac82a05485f024266dc98713b8
4+
bd620fbc225207d0abf8261847d0d942a75c939ccd3983293f4a096f547addb4
5+
abfa1524bf5ea0fa2f5903068b5def272cbb73073a295c58a9e30a65d35ff2ae

0 commit comments

Comments
 (0)